Fully Executed Contract - Laserfiche WebLink

Home Browse Search

ATTAGHMENT A HIPAA AND DATA SECURITY REOUIREMENTS 5. Access. a, Business Associate shall make available PHI that it holds that is part of a Designated Record Set when requested by DOC or the lndividual as necessary to satisfy DOC's obligations under 45 CFR 164.524 (Access of lndividuals to Protected Health lnformation). b. When the request is made by the lndividual to the Business Associate or if DOC asks the Business Associate to respond to a request, the Business Associate shall comply with requirements in 45 CFR 164,524 (Access of lndividuals to Protected Health lnformation) on form, time and manner of access. When the request is rnade by DOC, the Business Associate shall provide the records to DOC within ten (10) business days. 6. Amendment. a, lf DOC amends, in whole or in part, a record or PHI contained in an lndividual's Designated Record Set and DOC has previously provided the PHI or record that is the subject of the arnendment to Business Associate, then DOC will inform Business Associate of the amendrnent pursuant to 45 CFR 16a.526(c)(3) (Amendment of Protected Health lnformation). b. Business Associate shall make any amendments to PHI in a Designated Record Set as direcied by DOC or as necessary to satisfy DOC's obligations under 45 CFR 164.526 (Amendment of Protected Health lnformation). 7. Subcontracts and other Third Party Agreements. ln accordance with 45 CFR 164.502(e)(1Xii), 164.504(eX1Xi), and 164.308(bX2), Business Associate shall ensure that any agents, Subcontractors, independent contractors or other third parties that create, receive, maintain, or transmit PHI on Business Associate's behalf, enter into a written contract that contalns the same terms, restrictlons, requirements, and conditions as the HIPAA compliance provisions in this Agreement with respect to such PHl. The same provisions must also be included in any contracts by a Business Associate's Subcontractor with its own business associates as required by 45 CFR 164.31a(a)(2)(b) and 164.504(e)(5). 8. Obligations. To the extent the Business Associate is to carry out one or more of DOC's obligation(s) under Subpart E of 45 CFR Part 164 (Privacy of lndividually ldentifiable Health lnformation), Business Associate shall cornply with all requirernents that would apply to DOC in the performance of such obligation(s). 9. Liability, Within ten (10) business days, Business Associate must notify DOC of any complaint, enforcement or compliance action initiated by the Office for Civil Rights based on an allegation of violation of the HIPAA Rules and must inform DOC of the outcome of that action, Business Associate bears all responsibility for any penalties, fines or Warhington State Department of Correctlons Kl4078 Attachment A Page 5 of 19 26RAD